Hi All, I have created one index in test environment as like below.
[indexname]
homePath = $SPLUNK_DB/f5/db
coldPath = $SPLUNK_DB/f5/colddb
thawedPath = $SPLUNK_DB/f5/thaweddb
enableDataIntegrityControl = 0
#enableTsidxReduction = 0
maxTotalDataSizeMB = 180000
I don't see any bucket in coldDB path . But the bucket count in WARM is above 300. Why this data is not rolling out to cold and also to frozen. I am having the data greater than(around 200GB) maxTotalDataSizeMB.
splunk@hostname: # ls -lrt
total 72
drwx------ 2 splunk splunk 4096 Mar 12 2020 thaweddb
drwx------ 2 splunk splunk 4096 Jun 10 09:42 colddb
drwx------ 2 splunk splunk 4096 Jun 10 09:43 summary
drwx------ 3 splunk splunk 4096 Jun 10 09:43 datamodel_summary
drwx------ 283 splunk splunk 53248 Jun 10 10:51 db
splunk@hostname: # cd colddb
splunk@hostname: # ls -lrt
total 0
splunk@hostname: # pwd
/opt/splunk/var/lib/splunk/indexname/colddb
What is best practice i can do for rolling out in indexes.conf . Am i missing something ? Please let me know if you have any questions. Thank you
